====================================================== WARNING: possible circular locking dependency detected syzkaller #0 Tainted: G L ------------------------------------------------------ syz.0.1156/8945 is trying to acquire lock: ffff88801d6c7210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: __kernfs_remove+0x183/0xb80 fs/kernfs/dir.c:1558 but task is already holding lock: ffff88801d6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x51/0x120 fs/kernfs/dir.c:1792 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #9 (&root->kernfs_rwsem){++++}-{4:4}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631 kernfs_add_one+0x38/0xaa0 fs/kernfs/dir.c:825 kernfs_create_dir_ns+0x157/0x2b0 fs/kernfs/dir.c:1130 internal_create_group+0x36f/0xfb0 fs/sysfs/group.c:176 cpuhp_invoke_callback+0x3b4/0x9a0 kernel/cpu.c:194 cpuhp_issue_call+0x1b8/0x970 kernel/cpu.c:2354 __cpuhp_setup_state_cpuslocked+0x431/0x880 kernel/cpu.c:2507 __cpuhp_setup_state+0xf7/0x2f0 kernel/cpu.c:2536 do_one_initcall+0x11c/0x6f0 init/main.c:1357 do_initcall_level init/main.c:1419 [inline] do_initcalls init/main.c:1435 [inline] do_basic_setup init/main.c:1455 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1670 kernel_init+0x21/0x1e0 init/main.c:1560 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: -> #7 (cpu_hotplug_lock){++++}-{0:0}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline] percpu_down_read include/linux/percpu-rwsem.h:77 [inline] cpus_read_lock+0x42/0x170 kernel/cpu.c:490 static_key_slow_inc+0x12/0x30 kernel/jump_label.c:190 nbd_genl_reconnect_sock_cb+0x39f/0x990 drivers/block/nbd.c:1377 nbd_genl_foreach_sock+0x2ab/0x3e0 drivers/block/nbd.c:2152 nbd_genl_reconfigure+0x861/0xde0 drivers/block/nbd.c:2477 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> #6 (&nsock->tx_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 nbd_handle_cmd drivers/block/nbd.c:1143 [inline] nbd_queue_rq+0x42d/0xfa0 drivers/block/nbd.c:1207 blk_mq_dispatch_rq_list+0x428/0x1e60 block/blk-mq.c:2117 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline] __blk_mq_sched_dispatch_requests+0xcea/0x1620 block/blk-mq-sched.c:307 blk_mq_sched_dispatch_requests+0xd7/0x1c0 block/blk-mq-sched.c:329 blk_mq_run_work_fn+0x135/0x380 block/blk-mq.c:2531 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #5 (&cmd->lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 nbd_queue_rq+0xba/0xfa0 drivers/block/nbd.c:1199 blk_mq_dispatch_rq_list+0x428/0x1e60 block/blk-mq.c:2117 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline] __blk_mq_sched_dispatch_requests+0xcea/0x1620 block/blk-mq-sched.c:307 blk_mq_sched_dispatch_requests+0xd7/0x1c0 block/blk-mq-sched.c:329 blk_mq_run_work_fn+0x135/0x380 block/blk-mq.c:2531 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #4 (set->srcu){.+.+}-{0:0}: lock_sync kernel/locking/lockdep.c:5957 [inline] lock_sync+0xb5/0x120 kernel/locking/lockdep.c:5945 srcu_lock_sync include/linux/srcu.h:210 [inline] __synchronize_srcu+0xa2/0x300 kernel/rcu/srcutree.c:1462 blk_mq_wait_quiesce_done block/blk-mq.c:284 [inline] blk_mq_wait_quiesce_done block/blk-mq.c:281 [inline] blk_mq_quiesce_queue block/blk-mq.c:304 [inline] blk_mq_quiesce_queue+0x149/0x1c0 block/blk-mq.c:299 elevator_switch+0x17b/0x7e0 block/elevator.c:576 elevator_change+0x352/0x530 block/elevator.c:681 elevator_set_default+0x29e/0x360 block/elevator.c:754 blk_register_queue+0x48e/0x630 block/blk-sysfs.c:992 __add_disk+0x73f/0xe40 block/genhd.c:524 add_disk_fwnode+0x118/0x480 block/genhd.c:593 add_disk include/linux/blkdev.h:798 [inline] nbd_dev_add+0x779/0xb10 drivers/block/nbd.c:2026 nbd_init+0x2c5/0x2e0 drivers/block/nbd.c:2743 do_one_initcall+0x11c/0x6f0 init/main.c:1357 do_initcall_level init/main.c:1419 [inline] do_initcalls init/main.c:1435 [inline] do_basic_setup init/main.c:1455 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1670 kernel_init+0x21/0x1e0 init/main.c:1560 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #3 (&q->elevator_lock){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __mutex_lock_common kernel/locking/mutex.c:646 [inline] __mutex_lock+0x1a4/0x1bd0 kernel/locking/mutex.c:821 elevator_change+0x1bc/0x530 block/elevator.c:679 elevator_set_none+0x92/0xf0 block/elevator.c:769 blk_mq_elv_switch_none block/blk-mq.c:5102 [inline] __blk_mq_update_nr_hw_queues block/blk-mq.c:5147 [inline] blk_mq_update_nr_hw_queues+0x4c1/0x15f0 block/blk-mq.c:5212 nbd_start_device+0x1a6/0xbd0 drivers/block/nbd.c:1530 nbd_genl_connect+0xfc2/0x1760 drivers/block/nbd.c:2310 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg net/socket.c:815 [inline] ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2713 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767 __sys_sendmsg+0x160/0x210 net/socket.c:2799 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 blk_alloc_queue+0x610/0x790 block/blk-core.c:504 blk_mq_alloc_queue+0x174/0x290 block/blk-mq.c:4420 __blk_mq_alloc_disk+0x29/0x120 block/blk-mq.c:4467 nbd_dev_add+0x491/0xb10 drivers/block/nbd.c:1996 nbd_init+0x2c5/0x2e0 drivers/block/nbd.c:2743 do_one_initcall+0x11c/0x6f0 init/main.c:1357 do_initcall_level init/main.c:1419 [inline] do_initcalls init/main.c:1435 [inline] do_basic_setup init/main.c:1455 [inline] kernel_init_freeable+0x6ea/0x7b0 init/main.c:1670 kernel_init+0x21/0x1e0 init/main.c:1560 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 -> #1 (fs_reclaim){+.+.}-{0:0}: lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 __fs_reclaim_acquire mm/page_alloc.c:4375 [inline] fs_reclaim_acquire+0xc4/0x100 mm/page_alloc.c:4389 might_alloc include/linux/sched/mm.h:316 [inline] slab_pre_alloc_hook mm/slub.c:4636 [inline] slab_alloc_node mm/slub.c:4974 [inline] kmem_cache_alloc_noprof+0x63/0x6a0 mm/slub.c:5010 __kernfs_iattrs+0x126/0x450 fs/kernfs/inode.c:36 kernfs_iattrs fs/kernfs/inode.c:60 [inline] __kernfs_setattr+0x4d/0x3c0 fs/kernfs/inode.c:73 kernfs_iop_setattr+0xda/0x130 fs/kernfs/inode.c:127 notify_change+0xb25/0x1330 fs/attr.c:556 do_truncate+0x1df/0x240 fs/open.c:68 handle_truncate fs/namei.c:4300 [inline] do_open fs/namei.c:4841 [inline] path_openat+0x1e6d/0x2440 fs/namei.c:5000 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x121/0x770 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631 __kernfs_remove+0x183/0xb80 fs/kernfs/dir.c:1558 kernfs_remove_by_name_ns+0x7c/0x120 fs/kernfs/dir.c:1797 driver_sysfs_remove drivers/base/dd.c:523 [inline] __device_release_driver drivers/base/dd.c:1343 [inline] device_release_driver_internal+0x418/0x620 drivers/base/dd.c:1372 usb_driver_release_interface+0x10e/0x190 drivers/usb/core/driver.c:643 proc_ioctl+0x42f/0x680 drivers/usb/core/devio.c:2362 proc_ioctl_default drivers/usb/core/devio.c:2405 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2769 [inline] usbdev_ioctl+0x1023/0x3a90 drivers/usb/core/devio.c:2829 compat_ptr_ioctl+0x6e/0xa0 fs/ioctl.c:634 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x2cf/0x360 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e other info that might help us debug this: Chain exists of: &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&root->kernfs_rwsem); lock(cpuhp_state_mutex); lock(&root->kernfs_rwsem); lock(&root->kernfs_iattr_rwsem); *** DEADLOCK *** locks held by syz.0.1156/8945: 4, last CPU#1: #0: ffff8880216941d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff8880216941d8 (&dev->mutex){....}-{4:4}, at: usbdev_do_ioctl drivers/usb/core/devio.c:2613 [inline] #0: ffff8880216941d8 (&dev->mutex){....}-{4:4}, at: usbdev_ioctl+0x1a7/0x3a90 drivers/usb/core/devio.c:2829 #1: ffff88802a0811a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #1: ffff88802a0811a0 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline] #1: ffff88802a0811a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb2/0x620 drivers/base/dd.c:1369 #2: ffff88801d6c72a0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x49/0x120 fs/kernfs/dir.c:1791 #3: ffff88801d6c7180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x51/0x120 fs/kernfs/dir.c:1792 stack backtrace: CPU: 1 UID: 0 PID: 8945 Comm: syz.0.1156 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_circular_bug.cold+0x178/0x1be kernel/locking/lockdep.c:2059 check_noncircular+0x146/0x160 kernel/locking/lockdep.c:2191 check_prev_add+0xeb/0xe60 kernel/locking/lockdep.c:3181 check_prevs_add kernel/locking/lockdep.c:3300 [inline] validate_chain kernel/locking/lockdep.c:3924 [inline] __lock_acquire+0x1492/0x1ec0 kernel/locking/lockdep.c:5254 lock_acquire kernel/locking/lockdep.c:5908 [inline] lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5865 down_write+0x8b/0x1f0 kernel/locking/rwsem.c:1631 __kernfs_remove+0x183/0xb80 fs/kernfs/dir.c:1558 kernfs_remove_by_name_ns+0x7c/0x120 fs/kernfs/dir.c:1797 driver_sysfs_remove drivers/base/dd.c:523 [inline] __device_release_driver drivers/base/dd.c:1343 [inline] device_release_driver_internal+0x418/0x620 drivers/base/dd.c:1372 usb_driver_release_interface+0x10e/0x190 drivers/usb/core/driver.c:643 proc_ioctl+0x42f/0x680 drivers/usb/core/devio.c:2362 proc_ioctl_default drivers/usb/core/devio.c:2405 [inline] usbdev_do_ioctl drivers/usb/core/devio.c:2769 [inline] usbdev_ioctl+0x1023/0x3a90 drivers/usb/core/devio.c:2829 compat_ptr_ioctl+0x6e/0xa0 fs/ioctl.c:634 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x2cf/0x360 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f17fec Code: Unable to access opcode bytes at 0xf7f17fc2. RSP: 002b:00000000f53b550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0105512 RDX: 0000000080000200 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_register_driver returned -16